performing-timeline-reconstruction-with-plaso

使用 Plaso 执行时间线重建

适用场景

• 当需要从多个证据源构建全面的取证时间线时
• 用于关联文件系统元数据、事件日志、浏览器历史和注册表中的事件
• 在需要按时间顺序重建活动的复杂调查中
• 当标准日志分析不足以确定事件顺序时
• 用于以可视化、按时间顺序的格式呈现调查发现

前提条件

• 在取证工作站上安装 Plaso（log2timeline/psort）
• 取证磁盘镜像，格式为 raw（dd）、E01 或 VMDK
• 为 Plaso 输出预留足够存储空间（可能达到镜像大小的 10 倍以上）
• 至少 8GB RAM（处理大型镜像建议 16GB 以上）
• 用于可视化的 Timeline Explorer（Eric Zimmerman）或 Timesketch
• 了解时间戳类型（MACB：Modified、Accessed、Changed、Born）

工作流

步骤 1：安装 Plaso 并准备环境

# Install Plaso on Ubuntu/Debian
sudo add-apt-repository ppa:gift/stable
sudo apt-get update
sudo apt-get install plaso-tools

# Or install via pip
pip install plaso

# Or use Docker (recommended for dependency isolation)
docker pull log2timeline/plaso

# Verify installation
log2timeline.py --version
psort.py --version

# Create output directory
mkdir -p /cases/case-2024-001/timeline/

# Verify the forensic image
img_stat /cases/case-2024-001/images/evidence.dd

步骤 2：使用 log2timeline 生成 Plaso 存储文件

# Basic processing of a disk image (all parsers)
log2timeline.py \
   --storage-file /cases/case-2024-001/timeline/evidence.plaso \
   /cases/case-2024-001/images/evidence.dd

# Process with specific parsers for faster targeted analysis
log2timeline.py \
   --parsers "winevtx,prefetch,mft,usnjrnl,lnk,recycle_bin,chrome_history,firefox_history,winreg" \
   --storage-file /cases/case-2024-001/timeline/evidence.plaso \
   /cases/case-2024-001/images/evidence.dd

# Process with a filter file to focus on specific paths
cat << 'EOF' > /cases/case-2024-001/timeline/filter.txt
/Windows/System32/winevt/Logs
/Windows/Prefetch
/Users/*/NTUSER.DAT
/Users/*/AppData/Local/Google/Chrome
/Users/*/AppData/Roaming/Mozilla/Firefox
/$MFT
/$UsnJrnl:$J
/Windows/System32/config
EOF

log2timeline.py \
   --filter-file /cases/case-2024-001/timeline/filter.txt \
   --storage-file /cases/case-2024-001/timeline/evidence.plaso \
   /cases/case-2024-001/images/evidence.dd

# Using Docker
docker run --rm -v /cases:/cases log2timeline/plaso log2timeline \
   --storage-file /cases/case-2024-001/timeline/evidence.plaso \
   /cases/case-2024-001/images/evidence.dd

# Process multiple evidence sources into one timeline
log2timeline.py \
   --storage-file /cases/case-2024-001/timeline/combined.plaso \
   /cases/case-2024-001/images/workstation.dd

log2timeline.py \
   --storage-file /cases/case-2024-001/timeline/combined.plaso \
   /cases/case-2024-001/images/server.dd

步骤 3：使用 psort 过滤并导出时间线

# Export full timeline to CSV (super-timeline format)
psort.py \
   -o l2tcsv \
   -w /cases/case-2024-001/timeline/full_timeline.csv \
   /cases/case-2024-001/timeline/evidence.plaso

# Export with date range filter (focus on incident window)
psort.py \
   -o l2tcsv \
   -w /cases/case-2024-001/timeline/incident_window.csv \
   /cases/case-2024-001/timeline/evidence.plaso \
   "date > '2024-01-15 00:00:00' AND date < '2024-01-20 23:59:59'"

# Export in JSON Lines format (for ingestion into SIEM/Timesketch)
psort.py \
   -o json_line \
   -w /cases/case-2024-001/timeline/timeline.jsonl \
   /cases/case-2024-001/timeline/evidence.plaso

# Export with specific source type filters
psort.py \
   -o l2tcsv \
   -w /cases/case-2024-001/timeline/registry_events.csv \
   /cases/case-2024-001/timeline/evidence.plaso \
   "source_short == 'REG'"

psort.py \
   -o l2tcsv \
   -w /cases/case-2024-001/timeline/evtx_events.csv \
   /cases/case-2024-001/timeline/evidence.plaso \
   "source_short == 'EVT'"

# Export for Timeline Explorer (dynamic CSV)
psort.py \
   -o dynamic \
   -w /cases/case-2024-001/timeline/timeline_explorer.csv \
   /cases/case-2024-001/timeline/evidence.plaso

步骤 4：使用 Timesketch 分析时间线

# Install Timesketch (Docker deployment)
git clone https://github.com/google/timesketch.git
cd timesketch
docker compose up -d

# Import Plaso file into Timesketch via CLI
timesketch_importer \
   --host http://localhost:5000 \
   --username analyst \
   --password password \
   --sketch_id 1 \
   --timeline_name "Case 2024-001 Workstation" \
   /cases/case-2024-001/timeline/evidence.plaso

# Alternatively, import JSONL
timesketch_importer \
   --host http://localhost:5000 \
   --username analyst \
   --sketch_id 1 \
   --timeline_name "Case 2024-001" \
   /cases/case-2024-001/timeline/timeline.jsonl

# In Timesketch web UI:
# 1. Search for events: "data_type:windows:evtx:record AND event_identifier:4624"
# 2. Apply Sigma analyzers for automated detection
# 3. Star/tag important events
# 4. Create stories documenting the investigation narrative
# 5. Share with team members

步骤 5：执行针对性时间线分析

# Analyze specific time periods around known events
python3 << 'PYEOF'
import csv
from collections import defaultdict
from datetime import datetime

# Load incident window timeline
events_by_hour = defaultdict(list)
source_counts = defaultdict(int)

with open('/cases/case-2024-001/timeline/incident_window.csv', 'r', errors='ignore') as f:
    reader = csv.DictReader(f)
    total = 0
    for row in reader:
        total += 1
        timestamp = row.get('datetime', row.get('date', ''))
        source = row.get('source_short', row.get('source', 'Unknown'))
        description = row.get('message', row.get('desc', ''))

        source_counts[source] += 1

        # Group by hour for activity patterns
        try:
            dt = datetime.strptime(timestamp[:19], '%Y-%m-%dT%H:%M:%S')
            hour_key = dt.strftime('%Y-%m-%d %H:00')
            events_by_hour[hour_key].append({
                'time': timestamp,
                'source': source,
                'description': description[:200]
            })
        except (ValueError, TypeError):
            pass

print(f"Total events in incident window: {total}\n")

print("=== EVENTS BY SOURCE TYPE ===")
for source, count in sorted(source_counts.items(), key=lambda x: x[1], reverse=True):
    print(f"  {source}: {count}")

print("\n=== ACTIVITY BY HOUR ===")
for hour in sorted(events_by_hour.keys()):
    count = len(events_by_hour[hour])
    bar = '#' * min(count // 10, 50)
    print(f"  {hour}: {count:>6} events {bar}")

# Find hours with unusual activity spikes
avg = total / max(len(events_by_hour), 1)
print(f"\n=== ANOMALOUS HOURS (>{avg*3:.0f} events) ===")
for hour in sorted(events_by_hour.keys()):
    if len(events_by_hour[hour]) > avg * 3:
        print(f"  {hour}: {len(events_by_hour[hour])} events (SPIKE)")
PYEOF

关键概念

概念	描述
超级时间线	将来自多个来源的所有工件时间戳组合成统一的按时间顺序视图
MACB 时间戳	Modified、Accessed、Changed（元数据）、Born（创建）- 四种关键文件时间戳类型
Plaso 存储文件	基于 SQLite 的中间格式，用于在导出前存储已解析事件
L2T CSV	Log2timeline CSV 格式，具有用于时间线事件的标准化列
解析器	Plaso 模块，用于从特定工件类型（例如 winevtx、prefetch）提取时间戳
Psort	Plaso 排序和过滤工具，用于对存储文件进行后处理
Timesketch	Google 开源的协作式时间线分析平台
关键点	已知时间戳（例如恶意软件执行），用于聚焦调查范围

工具与系统

工具	用途
log2timeline（Plaso）	主要时间线生成引擎，可解析 100 多种工件类型
psort	Plaso 输出过滤、排序和导出工具
Timesketch	基于 Web 的协作式取证时间线分析平台
Timeline Explorer	Eric Zimmerman 的 Windows GUI，用于 CSV 时间线分析
KAPE	自动分流收集，可输入 Plaso 处理
mactime（TSK）	从 Sleuth Kit bodyfiles 生成更简单的时间线
Excel/Sheets	用于小型过滤数据集的手动时间线审查
Elastic/Kibana	用于 JSONL 时间线数据的替代可视化平台

常见场景

场景 1：勒索软件攻击重建 使用 Plaso 处理完整磁盘镜像，筛选至发现加密前一周，从浏览器历史记录和事件日志中识别初始访问媒介，通过注册表和 Prefetch 追踪权限提升，从网络登录事件映射横向移动，从显示大量文件修改的 MFT 时间戳精确定位加密开始时间。

场景 2：数据窃取调查 从嫌疑人的工作站创建超级时间线，筛选 USB 设备连接事件、文件访问时间戳和云存储浏览器活动，构建展示数据暂存、压缩和外泄的叙述，向法务团队展示带有标记证据点的时间线。

场景 3：多系统入侵分析 将所有受影响系统的磁盘镜像处理为单一 Plaso 存储文件，导入 Timesketch 进行协作分析，跨系统时间线搜索横向移动模式，识别零号病人系统和初始入侵媒介，映射整个环境中的完整攻击链。

场景 4：内部威胁非工作时间活动 将时间线筛选为仅非工作时间，识别正常工作时间之外的文件访问模式，与身份验证事件（门禁刷卡、VPN 登录）关联，搜索这些时段对敏感目录的数据访问，为 HR/法务构建证据包。

输出格式

Timeline Reconstruction Summary:
  Evidence Sources:
    Disk Image: evidence.dd (500 GB, NTFS)
    Plaso Storage: evidence.plaso (2.3 GB)

  Processing Statistics:
    Total events extracted: 4,567,890
    Parsers used: 45 (winevtx, prefetch, mft, usnjrnl, lnk, chrome, firefox, winreg, ...)
    Processing time: 3h 45m

  Incident Window (2024-01-15 to 2024-01-20):
    Events in window: 234,567
    Event Sources:
      MFT:          89,234
      Event Logs:   45,678
      USN Journal:  56,789
      Registry:     23,456
      Prefetch:     1,234
      Browser:      5,678
      LNK Files:    2,345
      Other:        10,153

  Key Timeline Events:
    2024-01-15 14:32 - Phishing email opened (browser)
    2024-01-15 14:33 - Malicious document downloaded
    2024-01-15 14:35 - PowerShell executed (Prefetch + Event Log)
    2024-01-15 14:36 - C2 connection established (Registry + Event Log)
    2024-01-16 02:30 - Mimikatz execution (Prefetch)
    2024-01-16 02:45 - Lateral movement to DC (Event Log)
    2024-01-17 03:00 - Data exfiltration (MFT + USN Journal)
    2024-01-18 03:00 - Log clearing (Event Log)

  Exported Files:
    Full Timeline:     /timeline/full_timeline.csv (4.5M rows)
    Incident Window:   /timeline/incident_window.csv (234K rows)
    Timesketch Import: /timeline/timeline.jsonl